[cross-compile] Make pkg/apparmor cross compilable #5084

rucoder · 2025-07-14T19:27:07Z

Description

Just for fun converted one of the packages into cross compilable. You can follow this pattern and do it for other packages as well. it may be tricky to run ./configure or figure out proper CFLAGS or install proper libraries into sysroot but it is possible

main trick is how sysroot is created. I'm using

FROM --platform=${TARGETPLATFORM} lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as target-sysroot

and then we can install all required target libraries like

ENV BUILD_PKGS="musl-dev libgcc musl-libintl libintl  linux-headers"
RUN eve-alpine-deploy.sh

our cross compiler is broken and doesn't accept --sysroot however it is build with fixed --sysroot=/usr/x86_64-alpine-linux-musl for aarch64 so we just copy libraries from our sysrot to this location

How to test and validate this PR

docker buildx build --platform=linux/arm64 -t cross-test-1 --load .
docker run -it cross-test-1 /bin/bash

run file /usr/bin/apparmor_parser to make sure it is of aarch64 architecture.

repeat these steps for all other architectures

PR Backports

- 14.5-stable: No
- 13.4-stable: No

Checklist

I've provided a proper description
I've added the proper documentation
I've tested my PR on amd64 device
I've tested my PR on arm64 device
I've written the test verification instructions
I've set the proper labels to this PR

And the last but not least:

I've checked the boxes above, or I've provided a good reason why I didn't
check them.

Please, check the boxes above after submitting the PR in interactive mode.

fix ENV/VAR syntax Signed-off-by: Mikhail Malyshev <[email protected]>

Make pkg/apparmor cross compilable - the main trick is how sysroot is created by importing --platform=${TARGETPALTFORM} alpine - our cross compiler expects sysroot to be at fixed locations and doesn't accept --sysroot Signed-off-by: Mikhail Malyshev <[email protected]>

OhmSpectator

Running the tests. Though, I don't understand the change yet...

christoph-zededa · 2025-07-15T08:01:19Z

pkg/apparmor/Dockerfile

 WORKDIR /apparmor/parser
 RUN ../common/list_af_names.sh > base_af_names.h && \
-    make
+    make -j"$(nproc)"


a wise man once said: #4775 (comment) ;-)

@christoph-zededa yeah.. I was lazy to look for the proper variable name

christoph-zededa · 2025-07-15T08:05:17Z

Isn't riscv64 missing?

You can follow this pattern

I don't think it is a good idea to copy all this lines to other packages. Isn't it possible to make it easier for other packages to adopt it?

rucoder · 2025-07-15T09:28:25Z

Isn't riscv64 missing?

You can follow this pattern

I don't think it is a good idea to copy all this lines to other packages. Isn't it possible to make it easier for other packages to adopt it?

It is, but apparmor is not a part of riscv build and we do not have a crosscompiler. Would be nice to move to clang which is cross compiler by default but it may be tricky to run configure if it doesn't support it

For the second question. It is possible to some extent like I did in lfedge/eve-rust but for rust you always have the same environment you want to set and for C it is always different. Besides having one more intermediate package is a pain. You need to update intermediate builder first and then your target package

deitch · 2025-07-15T18:28:55Z

pkg/apparmor/Dockerfile

+FROM --platform=${BUILDPLATFORM} lfedge/eve-cross-compilers:fb809cfb1909752acb563e0b77cd3799534bce64 AS cross-compilers
+
+FROM builder-native-base as builder-cross-base
+COPY --from=cross-compilers /packages /packages


Can you not just move FROM .... AS cross-compilers to before line 6 (previous FROM), and then COPY these into builder-native-base? Or is this a different platform?

This needs comments to make it clear what each one is doing, as well as how the whole flow works. I mostly get what you are doing, but miss some of the steps.

rene · 2025-07-16T11:33:46Z

pkg/apparmor/Dockerfile

-FROM lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as build
-ENV BUILD_PKGS linux-headers musl-dev musl-utils musl-libintl git gcc g++ \
-               autoconf automake libtool make flex bison bash sed gettext
+FROM --platform=${BUILDPLATFORM} lfedge/eve-alpine:0f2e0da38e30753c68410727a6cc269e57ff74f2 as builder-native-base


FROM ... AS ... (as uppercase as well)...

rene · 2025-07-16T11:39:42Z

pkg/apparmor/Dockerfile

+COPY --from=cross-compilers /packages /packages
+
+FROM builder-cross-base as builder-target-arm64
+ARG COMPILER_TARGET_ARCH=aarch64


In the documentation (https://github.com/lf-edge/eve/blob/master/docs/BUILD.md#cross-compilation-support), we recommend to call this variable EVE_TARGET_ARCH, as used in other packages... not critical, but would be good to keep the pattern...

rene · 2025-07-16T11:42:33Z

Isn't riscv64 missing?

You can follow this pattern

I don't think it is a good idea to copy all this lines to other packages. Isn't it possible to make it easier for other packages to adopt it?

It is, but apparmor is not a part of riscv build and we do not have a crosscompiler. Would be nice to move to clang which is cross compiler by default but it may be tricky to run configure if it doesn't support it

For the second question. It is possible to some extent like I did in lfedge/eve-rust but for rust you always have the same environment you want to set and for C it is always different. Besides having one more intermediate package is a pain. You need to update intermediate builder first and then your target package

We do have cross-compiler for riscv64 from hosts x86_64 and arm64. What we don't have is cross-compiler for x86_64 and arm64 from riscv64 hosts. If this image can be built for riscv64 without issues, let's add the cross-compilation for it as well. If it has issues (like pillar), then is not worth of change....

rene · 2025-07-16T12:09:59Z

pkg/apparmor/Dockerfile

+FROM builder-target as builder-amd64-arm64
+ENV CONFIGURE_TARGETS="--build=aarch64-alpine-linux-musl --host=x86_64-alpine-linux-musl"
+# copy libraries from target-sysroot
+COPY --from=target-sysroot /usr/lib/ /usr/x86_64-alpine-linux-musl/lib/


instead of copying the whole /usr/lib and /usr/include you can use an approach like this to create the target libraries:
https://github.com/lf-edge/eve/blob/master/pkg/pillar/Dockerfile#L40

so you install only the libraries you need and they will be available at /out, you can even use a single code block to automate the process for the target architecture: https://github.com/lf-edge/eve/blob/master/pkg/pillar/Dockerfile#L53

@rene sure, I actually did not mean to merge it to be honest, but I can fix it 👍

Fix Dockerfile syntax and copyright date

7fc968b

fix ENV/VAR syntax Signed-off-by: Mikhail Malyshev <[email protected]>

rucoder requested a review from shjala as a code owner July 14, 2025 19:27

github-actions bot requested a review from eriknordmark July 14, 2025 19:27

rucoder requested review from OhmSpectator, christoph-zededa and rene July 14, 2025 19:28

rucoder changed the title ~~Rucoder/cross app armor~~ [cross-compile] Make pkg/apparmor cross compilable Jul 14, 2025

rucoder force-pushed the rucoder/cross-app-armor branch from d68971e to b3559b7 Compare July 14, 2025 19:51

rucoder force-pushed the rucoder/cross-app-armor branch from b3559b7 to 5d06ac9 Compare July 14, 2025 19:52

OhmSpectator approved these changes Jul 14, 2025

View reviewed changes

OhmSpectator added the side-quest A worthy adventure, but not essential for victory. Tackle when the main quest is safe! label Jul 14, 2025

christoph-zededa reviewed Jul 15, 2025

View reviewed changes

deitch reviewed Jul 15, 2025

View reviewed changes

rene reviewed Jul 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[cross-compile] Make pkg/apparmor cross compilable #5084

[cross-compile] Make pkg/apparmor cross compilable #5084

Uh oh!

rucoder commented Jul 14, 2025 •

edited

Loading

Uh oh!

OhmSpectator left a comment

Uh oh!

christoph-zededa Jul 15, 2025

Uh oh!

rucoder Jul 21, 2025

Uh oh!

christoph-zededa commented Jul 15, 2025

Uh oh!

rucoder commented Jul 15, 2025 •

edited

Loading

Uh oh!

deitch Jul 15, 2025

Uh oh!

rene Jul 16, 2025

Uh oh!

rene Jul 16, 2025

Uh oh!

rene commented Jul 16, 2025

Uh oh!

rene Jul 16, 2025

Uh oh!

rucoder Jul 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

[cross-compile] Make pkg/apparmor cross compilable #5084

Are you sure you want to change the base?

[cross-compile] Make pkg/apparmor cross compilable #5084

Uh oh!

Conversation

rucoder commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How to test and validate this PR

PR Backports

Checklist

Uh oh!

OhmSpectator left a comment

Choose a reason for hiding this comment

Uh oh!

christoph-zededa Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

rucoder Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

christoph-zededa commented Jul 15, 2025

Uh oh!

rucoder commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deitch Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

rene Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

rene Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

rene commented Jul 16, 2025

Uh oh!

rene Jul 16, 2025

Choose a reason for hiding this comment

Uh oh!

rucoder Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rucoder commented Jul 14, 2025 •

edited

Loading

rucoder commented Jul 15, 2025 •

edited

Loading